If you like your privacy when you are using your cellphone or surfing cyberspace, then you might find it disturbing how easily you can be personally identified while doing either. Researchers exploited anonymized location mobility traces and social networks to deanonymize users.

Email a friend

To

Use commas to separate multiple email addresses

From

Thank you

Sorry

If you like your privacy when you are using your cellphone or surfing cyberspace, then you might find it disturbing how easily you can be personally identified while doing either. Here's a look at two different deanonymizing processes by which your privacy can be obliterated.

Location-based services sometimes offer to protect user privacy and anonymize or obfuscate personally identifiable information (PII) in the location data. There has been research in the past showing ways to defeat the anonymization, but new research showed "these methods can be effectively defeated: a set of location traces can be deanonymized given an easily obtained social network graph."

This week at the Association for Computing Machinery's Computer and Communications Security (ACM CCS) conference in Raleigh, NC, researchers Mudhakar Srivatsa and Mike Hicks are to present "Deanonymizing mobility traces: using social networks as a side-channel" [PDF]. It's interesting how the mobility traces were matched to a contact graph and then social networks were exploited to find friendships via Facebook data and business relationships via LinkedIn.

Matching a user's mobility trace to their identity "can provide information about habits, interests and activities—or anomalies to them—which in turn may be exploited for illicit gain via theft, blackmail, or even physical violence," stated the research. It's worth a read to see how the researchers used Wi-Fi hotspots on a university campus, captured chats via instant messengers, as well as Bluetooth connectivity to show inter-user correlations. In these social network side channel attacks, they were able to strip out privacy and deanonymize users via their mobility traces with an accuracy of 80%. And this flyer claimed that the "proposed algorithms to quantify information released in location traces, using social networks as a side-channel, are within 90% of the optimal."

This paper studied the use of interuser correlation models to address this problem. In particular, we exploited structural similarities between two sources of inter-user correlations (the contact graph and the social network) and developed techniques to leverage such structural similarities to deduce mapping between nodes in the contact graph with that in the social network, thereby de-anonymizing the contact graph (and thus the underlying mobility trace). We validated our hypothesis using three real world datasets and showed that the proposed approach achieves over 80% accuracy, while incurring no more than a few minutes of computational cost in de-anonymizing these mobility traces.

Since we've also previously looked at cookiejacking, let's hone in specifically on Followjacking via Twitter and Likejacking via Facebook. You should read Grossman's article, but here's his shorter explanation and demonstration in a video.

By now it should be clear that this style of attack can be extended to LinkedIn, Google+, and other online services providing similar functionality. That list is quite long.

I would like to reiterate a key lesson and highlight a new one.

If a browser is logged-in to a social network or similar identity storage website, as many are persistently, a single-mouse click is all it takes for any website to reveal a visitor's real name and other personal information.

If the browser happens to have the popular Tor proxy installed, it does not provide any protection against deanonymization via Likejacking and Followjacking.

Can we actually call this clickjacking --> deanonymization issue a "vulnerability?" If so, who is responsible for dealing with it? The browser vendors? The logged-in visitor? The social networking website(s)? The Web standards bodies?

All of deanonymization examplifies where your identity can be revealed via alleged anonymized location data from a mobile device, or via one click and a website can find out pretty much everything about you, actually create more questions than answers. Both are disturbing from a privacy/security perspective.